GHSA-v5gf-vpjc-pc7w CVE-2026-105866
Payload: Unauthenticated account-lockout denial of service
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.37%
- Chance of exploitation in the next 30 days. Higher than 30.76% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-307 Improper Restriction of Excessive Authentication Attempts
- CWE-645 Overly Restrictive Account Lockout Mechanism
- Fix
3.90.0- Upgrade payload to this version or later
Description
Impact
An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.
You are affected if:
- Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout.
Applications that do not use Payload local authentication are not affected.
Patches
Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| payload | < 3.90.0 |
3.90.0 |
| payload | >= 4.0.0-canary.0, < 4.0.0-canary.34 |
4.0.0-canary.34 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
payload npm → 3.90.0
- npm
npm install payload@3.90.0- yarn
yarn add payload@3.90.0- pnpm
pnpm add payload@3.90.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How to prevent it
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
CWE-645: Overly Restrictive Account Lockout Mechanism
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
How to prevent it
- Architecture and Design: Implement more intelligent password throttling mechanisms such as those which take IP address into account, in addition to the login name.
- Architecture and Design: Implement a lockout timeout that grows as the number of incorrect login attempts goes up, eventually resulting in a complete lockout.
- Architecture and Design: Consider alternatives to account lockout that would still be effective against password brute force attacks, such as presenting the user machine with a puzzle to solve (makes it do some computation).
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript | High | Also affects payload |
| GHSA-p223-2wr2-j562 Payload: Incomplete validation during the upload file lifecycle | High | Also affects payload |
| GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue | Critical | Also affects payload |
| GHSA-2pwp-2369-8fg3 Payload: Bypassed sanitization of user uploaded SVGs | High | Also affects payload |
| GHSA-pj5h-5q6c-3pfx Payload external upload trust validation issue | High | Also affects payload |
| GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents | Critical | Also affects payload |
| GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register | High | Also affects payload |
| GHSA-fx49-4h83-wjv9 Payload didn't enforce field-level password update restrictions | High | Also affects payload |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor